diff --git a/flake.lock b/flake.lock
index 85b859c27fb..8244010c2b9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -52,17 +52,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1792912755,
-        "narHash": "sha256-Zs+3vv/BbQTFVbuMpC3+ENdnjVIDiOwlrPjyhP23RUk=",
+        "lastModified": 1793742712,
+        "narHash": "sha256-xQ0Fh8c+Ujf2BbSzs00rURaPRC9MNukbSBx89itl/SM=",
         "owner": "compoundingtech",
         "repo": "fabric",
-        "rev": "1e6e93e9a662a40749f91d63eeecc4e98de114bd",
+        "rev": "19e7f8964ce8305aeb8c200fb717967aa03f738f",
         "type": "github"
       },
       "original": {
         "owner": "compoundingtech",
         "repo": "fabric",
-        "rev": "1e6e93e9a662a40749f91d63eeecc4e98de114bd",
+        "rev": "19e7f8964ce8305aeb8c200fb717967aa03f738f",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index 3b51b70b5a9..7e44d4dd86a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,8 +9,8 @@
     # The runtime, Rust crates and native terminal library share one producer revision.
     pty.url = "github:compoundingtech/pty/79d526d1be4f77bb3764dc1d880492806f8a07fc";
     pty.inputs.nixpkgs.follows = "nixpkgs";
-    # Merged pairing stack, including the daemon-identity restricted client.
-    fabric.url = "github:compoundingtech/fabric/1e6e93e9a662a40749f91d63eeecc4e98de114bd";
+    # Fabric v0.9.4 includes bounded peer expiry and recoverable identity rotation.
+    fabric.url = "github:compoundingtech/fabric/19e7f8964ce8305aeb8c200fb717967aa03f738f";
     fabric.inputs.nixpkgs.follows = "nixpkgs";
     # Shared CI generators and the `otelite` collector used by release-integration.
     # Keep the build toolchain aligned with the source member in megarepo.kdl.
diff --git a/release-notes/fabric-v094-flake-pin.json b/release-notes/fabric-v094-flake-pin.json
new file mode 100644
index 00000000000..cd7830e5896
--- /dev/null
+++ b/release-notes/fabric-v094-flake-pin.json
@@ -0,0 +1,32 @@
+{
+  "version": 1,
+  "summary": "Pin the Fabric flake input from 1e6e93e9 (package version 0.9.2) to v0.9.4 (19e7f8964ce8305aeb8c200fb717967aa03f738f) for packages.fabric-pairing only; no Fractal runtime change",
+  "replay": {
+    "status": "none",
+    "detail": "No claim replay or recovery behavior changes in Fractal. This change only selects the external Fabric package revision."
+  },
+  "schema": {
+    "status": "none",
+    "detail": "No Fractal tables, indexes, schema versions, stored formats or data rewrites change."
+  },
+  "rules": {
+    "status": "none",
+    "detail": "No checkpoint rule or digest changes."
+  },
+  "compatibility": {
+    "status": "changed",
+    "detail": "The fabric flake input and lock move from 1e6e93e9a662a40749f91d63eeecc4e98de114bd (package version 0.9.2) to Fabric v0.9.4 at 19e7f8964ce8305aeb8c200fb717967aa03f738f. Production hosts currently run Fabric v0.9.3 (285bd482), a separate deployment baseline rather than the previous flake pin. The input's only consumer is packages.fabric-pairing; Fractal runtime code, Cargo dependencies and deployed services are unchanged."
+  },
+  "downtime": {
+    "status": "none",
+    "detail": "The pin does not restart or deploy Fabric or Fractal."
+  },
+  "manual": {
+    "status": "changed",
+    "detail": "For the re-key rollout, deploy Fabric v0.9.4 on every participating member first, before deploying the Fractal re-key changes or starting any re-key."
+  },
+  "recovery": {
+    "status": "none",
+    "detail": "Changing this package pin writes no runtime state. It does not authorize an in-place downgrade of a Fabric daemon that has already written expiry state."
+  }
+}